A security scanning method and device

Abstract

The present application provides a security scanning method and apparatus for improving the accuracy of security scanning. The security scanning method includes: obtaining a detected static source code in response to a security scanning instruction; converting the detected static source code into a first structural representation based on key syntax information and code line number information contained in the detected static source code; wherein the first structure is used to indicate key syntax information contained in the detected static source code, and the first structural representation includes code line number information of each key syntax information in the detected static source code; obtaining a stream data representation of the detected static source code based on the first structural representation, wherein the stream data is used to indicate at least one logical relationship contained in the detected static source code; and performing a security scan based on the stream data.

Description

Technical Field

[0001] The present application relates to the field of computer technology, and in particular to a security scanning method and device. Background Art

[0002] Currently, the industry's technical solutions for automated testing of application security include static application security testing (SAST). SAST's solution is to directly analyze static source code files. However, during the analysis process, the static source code is not executed. Instead, the presence of security vulnerabilities is determined based on only some features in the static source code. Typically, the SAST technical solution is implemented as follows: based on the security vulnerability, the vulnerability component that specifically causes the problem is analyzed, and by analyzing the features of the vulnerability component, specific key information (including fingerprints, keywords, method names, etc.) is extracted; then, based on the vulnerability attack path, key implementations (including method names, reinforcement components, etc.) are extracted based on the security reinforcement methods of all protection points during the vulnerability attack process; finally, a set of regular expressions is generated based on the above-extracted specific key information and key implementations, and the regular expressions are used for security scanning.

[0003] Although in the above technical solution, for key information and key implementations, security scanning can be relatively simple achieved by generating regular expressions, it has the disadvantage of being unable to analyze attack paths, resulting in the inability to accurately identify security vulnerabilities and a high number of false positives. Summary of the Invention

[0004] The present application provides a security scanning method and device for more accurately identifying security vulnerabilities and reducing the occurrence of false positives.

[0005] In a first aspect, a security scanning method is provided, the method comprising: obtaining a detected static source code in response to a security scanning instruction; converting the detected static source code into a first structural representation based on key syntax information and code line number information contained in the detected static source code; wherein the first structure is used to indicate key syntax information contained in the detected static source code, and the first structural representation contains code line number information of each key syntax information in the detected static source code; obtaining a stream data representation of the detected static source code based on the first structural representation, the stream data being used to indicate at least one logical relationship contained in the detected static source code; and performing a security scan based on the stream data.

[0006] The beneficial effects of this method are as follows: in order to solve the disadvantage of high false positive rate in security scanning based on static source code in the prior art, the method provided by this application converts the static source code and obtains a first structural representation based on the key grammatical information analyzed from the static source code; further, in order to achieve convenient and rapid tracking and positioning of the attack path, the first structural representation is further converted into a stream data representation that can represent the logical relationship, so that in the process of implementing security scanning based on the stream data, the attack path can be analyzed based on the logical relationship contained in the stream data. In addition, the method provided by this application can also parse the code line number information in the process of converting the static source code, so that the first structure after the conversion carries the code line number information of the detected static source code. Therefore, after the security scan, it can also be inferred based on the code line number information which specific line of the detected static source code the code with the possible security vulnerability belongs to. The security scanning method provided by this application can improve the accuracy of the security scan and reduce the occurrence of false positive problems in the security scan results.

[0007] In one possible design, the flow data representation of the detected static source code is obtained based on the first structural representation, including: parsing from the first structural representation to obtain multiple syntax nodes, each syntax node having a calling relationship and / or a called relationship; generating a second structural representation of the detected static source code based on the calling relationship and / or the called relationship of each syntax node; the second structure contains the logical relationship of multiple syntax nodes in the detected static source code; obtaining a tree structure representation based on the second structural representation, the tree structure is used to indicate the logical relationship of multiple syntax nodes in the detected static source code; based on the tree structure, generating at least one control flow and a data flow matching each control flow; wherein, each control flow is used to indicate a logical relationship; integrating the control flow and the data flow to obtain the flow data representation.

[0008] The beneficial effects of this possible design are: this design provides a specific implementation method for obtaining stream data representation based on the first structure, and obtains a more complete logical relationship by analyzing the mutual calling relationship between the syntax nodes contained in the first structure. In order to clearly obtain the logical relationship contained in the static source code being tested, at least one logical relationship can be further obtained based on the tree representation of the second structure, and the logical relationship is represented by the control flow, thereby improving the computer's ability to understand the static source code being tested, and performing security vulnerability analysis based on the various control flows and data flows contained in the stream data during the security scan, thereby improving the accuracy of the security scan.

[0009] In one possible design, the obtaining of the detected static source code in response to a security scanning instruction includes: responding to a security scanning instruction for a static source code baseline version, using the static source code baseline version as the detected static source code; or, responding to a security scanning instruction for an iterative version of a static source code, and having locally stored security scanning results for the static source code baseline version, obtaining a code portion of the iterative version of the static source code that has changed relative to the baseline version, and using the changed code portion as the detected static source code; or, responding to a security scanning instruction for an iterative version of the static source code, and having locally stored security scanning results for a historical iterative version of the static source code, obtaining a code portion of the iterative version of the static source code that has changed relative to the historical iterative version, and using the changed code portion as the detected static source code.

[0010] The beneficial effects of this possible design are: the design provides several implementation methods for determining the static source code to be detected, taking into account that static source code generally has a baseline version that can implement basic functions and an iterative version that developers change in order to improve or develop more functions, but the static source code may need to be scanned multiple times for security. If the entire code content of the static source code is scanned for security each time, it has the disadvantage of low efficiency. Therefore, when there are security scan results for the baseline version or historical iterative version, it is possible to consider performing a security scan on the changed code part, thereby improving the efficiency of the security scan and reducing the time of the security scan.

[0011] In one possible design, the key syntax information includes at least one of the following: a class structure, a method structure, or an inheritance structure; the first structure is represented as an abstract syntax tree (AST). The AST parses the syntax information in the static source code being inspected and extracts unimportant details, thereby improving the accuracy of security scans.

[0012] In a possible design, the second structure is represented as a directed graph structure. By representing the detected static source code with a directed graph structure, the logical relationship contained in the detected static source code can be more clearly reflected.

[0013] In one possible design, a security scan is performed based on the stream data, including: traversing the stream data based on a retrieval keyword used for security scanning, the retrieval keyword being obtained through a security scanning rule; and if data matching the retrieval keyword exists in the traversed stream data, it indicates that a security vulnerability exists.

[0014] The beneficial effects of this possible design are: this design provides an implementation method for security scanning, first obtaining retrieval keywords based on security scanning rules, and then matching the detected static source code in the form of streaming data based on the retrieval keywords. When there is matching data, it indicates that the detected static source code may have security vulnerabilities, and then the code line corresponding to the matching data in the detected static source code can be found based on the code line number information, and the content of the code line can be checked for security vulnerabilities.

[0015] In a second aspect, an embodiment of the present application further provides a security scanning device, which includes modules / units for executing the method in any possible design of the first aspect. These modules / units can be implemented by hardware or by executing corresponding software implementations through hardware.

[0016] In a third aspect, embodiments of the present application further provide a computing device comprising a processor and a memory, the memory being coupled to the processor. Optionally, the device further comprises a display screen. The processor executes program instructions in the memory to perform the method provided in the first aspect or any possible implementation of the first aspect. The display screen is configured to display information to a user when triggered by the processor.

[0017] In a fourth aspect, the present application provides a computing device cluster, which includes at least one computing device provided in the third aspect.

[0018] In a fifth aspect, the present application provides a computer-readable storage medium comprising computer program instructions, which, when executed by a computing device, cause the computing device to perform the method provided in the aforementioned first aspect or any possible implementation of the first aspect. The storage medium includes, but is not limited to, volatile memory, such as random access memory, and non-volatile memory, such as flash memory, a hard disk drive (HDD), or a solid state drive (SSD).

[0019] In a sixth aspect, the present application provides a computer program product, comprising computer instructions that, when executed by a computing device, cause the computing device to perform the method provided in the aforementioned first aspect or any possible implementation of the first aspect. The computer program product may be a software installation package. When the method provided in the aforementioned first aspect or any possible implementation of the first aspect is required, the software installation package may be downloaded to the computing device and executed on the computing device.

[0020] In a seventh aspect, the present application also provides a computer chip, which is connected to a memory, and the chip is used to read and execute a software program stored in the memory to execute the method provided in the aforementioned first aspect or any possible implementation of the first aspect.

[0021] Among them, for the beneficial effects of the second to seventh aspects, please refer to the beneficial effects of each possible design in the first aspect, which will not be repeated here. BRIEF DESCRIPTION OF THE DRAWINGS

[0022] Figure 1a The implementation process of security scanning in related technologies;

[0023] Figure 1b A schematic diagram of the hardware structure of an electronic device provided in an embodiment of the present application;

[0024] Figure 1c A block diagram of the software architecture of an electronic device provided in an embodiment of the present application;

[0025] Figure 1d A schematic diagram of an application scenario of a security scanning method is provided for an embodiment of the present application;

[0026] Figure 2 An example diagram of an abstract syntax tree and a directed tree provided in an embodiment of the present application;

[0027] Figure 3 A schematic diagram of a flow chart of a security scanning method provided in an embodiment of the present application;

[0028] Figure 4 A schematic diagram of a front-end interface for obtaining detected static source code provided in an embodiment of the present application;

[0029] Figure 5 A schematic diagram of the process of obtaining stream data according to the AST structure provided in an embodiment of the present application;

[0030] Figure 6 A schematic diagram of a directed tree provided in an embodiment of the present application;

[0031] Figure 7a This is one of the structural diagrams of a security scanning method provided in an embodiment of the present application;

[0032] Figure 7b This is a second structural diagram of a security scanning method provided in an embodiment of the present application;

[0033] Figure 7c A third structural diagram of a security scanning method provided in an embodiment of the present application;

[0034] Figure 7dA fourth structural diagram of a security scanning method provided in an embodiment of the present application;

[0035] Figure 8a A front-end schematic diagram of a security scan result display list provided in an embodiment of the present application;

[0036] Figure 8b A schematic diagram of a security scan result provided in an embodiment of the present application;

[0037] Figure 9 A schematic diagram of an electronic device provided in an embodiment of the present application. DETAILED DESCRIPTION

[0038] With the rapid development of society, electronic devices such as mobile phones are becoming more and more popular. Electronic devices not only have communication functions, but also have powerful processing capabilities, storage capabilities, camera functions, etc. Electronic devices execute corresponding applications through operating systems (such as Android operating systems), and users can use electronic devices to make calls, send text messages, browse the web, take pictures, play games, watch videos, etc. Among them, in the process of developers writing static source code to implement software application functions in electronic devices, it is inevitable that there will be some security vulnerabilities in the static source code, which will lead to serious potential risks to the security of users in the process of using the software applications contained in the electronic devices. Therefore, it is necessary to perform a security scan on the static source code to check whether there are security vulnerabilities in the static source code.

[0039] In conjunction with the description of the background technology, there is a relatively simple security scanning solution for static source code using a regular expression method in the related technology, see Figure 1a The following content illustrates the implementation process of related technologies. In the SAST technical solution, the server first generates a set of regular expressions based on the specific key information and key implementations extracted from the analysis of the vulnerable component. Then, the server uses these regular expressions to perform a security scan of the static source code being tested. However, because related technologies only analyze static source code, they cannot analyze the attack process of security vulnerabilities, making it difficult to accurately identify security vulnerabilities and suffering from a high rate of false positives.

[0040] In light of this, the present application provides a security scanning method that, when implemented, can convert the static source code being inspected into an abstract syntax tree structure, then parse the logical relationships based on the abstract syntax tree structure to obtain a directed graph structure, thereby improving the accuracy of the security scan. Furthermore, the control flow and data flow obtained from the directed graph structure can be further generated and integrated to obtain flow data, and finally, a security scan can be performed based on the flow data. The specific implementation method is described in detail below.

[0041] It is understood that the embodiments of the present application can be applied to electronic devices such as mobile phones, tablet computers, wearable devices (e.g., watches, bracelets, helmets, headphones, etc.), vehicle-mounted devices, augmented reality (AR) / virtual reality (VR) devices, laptop computers, ultra-mobile personal computers (UMPCs), netbooks, personal digital assistants (PDAs), smart home devices (e.g., smart TVs, smart speakers, smart cameras, etc.). It is understood that the embodiments of the present application do not impose any restrictions on the specific types of electronic devices.

[0042] It should be understood that in the embodiments of the present application, "at least one" refers to one or more. "Multiple" refers to two or more. "And / or" describes the association relationship of associated objects, indicating that three relationships can exist. For example, A and / or B can represent three situations: A exists alone, A and B exist at the same time, and B exists alone. Among them, A and B can be singular or plural. The character " / " generally indicates that the objects associated before and after are in an "or" relationship. "At least one of the following" or similar expressions refers to any combination of these items, including any combination of single or plural items. For example, at least one of a, b or c can represent seven situations: a, b, c, a and b, a and c, b and c, or a, b and c. Among them, each of a, b, and c can be an element itself, or a set containing one or more elements. In addition, the words "first", "second", etc. involved in the embodiments of the present application are only used to distinguish the purpose of description, and cannot be understood as indicating or implying relative importance, nor can they be understood as indicating or implying order.

[0043] Exemplary embodiments of electronic devices to which the present application can be applied include but are not limited to those equipped with Or a portable electronic device with other operating systems. The portable electronic device may also be other portable electronic devices, such as a laptop computer with a touch-sensitive surface (eg, a touch panel).

[0044] Figure 1b A schematic diagram of the hardware structure of a possible electronic device is shown. Figure 1bAs shown, the electronic device 100 includes components such as a radio frequency (RF) circuit 110, a power supply 120, a processor 130, a memory 140, an input unit 150, a display unit 160, an audio circuit 170, a communication interface 180, and a wireless fidelity (WiFi) module 190. Those skilled in the art will understand that Figure 1b The hardware structure of the electronic device shown in the figure does not constitute a limitation on the electronic device. The electronic device provided in the embodiment of the present application may include more or fewer components than shown in the figure, may combine two or more components, or may have different component configurations. Figure 1b The various components shown in the drawings may be implemented in hardware, software, or a combination of hardware and software, including one or more signal processing and / or application specific integrated circuits.

[0045] The following combination Figure 1b The components of the electronic device 100 are described in detail.

[0046] The RF circuit 110 can be used to receive and transmit data during communications or calls. Specifically, after receiving downlink data from the base station, the RF circuit 110 sends it to the processor 130 for processing. Furthermore, the RF circuit 110 sends uplink data to the base station. Typically, the RF circuit 110 includes, but is not limited to, an antenna, at least one amplifier, a transceiver, a coupler, a low-noise amplifier (LNA), a duplexer, and the like.

[0047] In addition, the RF circuit 110 can also communicate with a network and other devices via wireless communications. The wireless communications can use any communication standard or protocol, including but not limited to Global System of Mobile Communications (GSM), General Packet Radio Service (GPRS), Code Division Multiple Access (CDMA), Wideband Code Division Multiple Access (WCDMA), Long Term Evolution (LTE), email, Short Messaging Service (SMS), etc.

[0048] WiFi technology is a short-range wireless transmission technology. The electronic device 100 can connect to an access point (AP) via the WiFi module 190 to access a data network. The WiFi module 190 can be used to receive and send data during the communication process.

[0049] The electronic device 100 can be physically connected to other devices via the communication interface 180. Optionally, the communication interface 180 is connected to the communication interface of the other device via a cable to achieve data transmission between the electronic device 100 and the other device.

[0050] Since the electronic device 100 can realize communication services and interact with the server in the embodiment of the present application, the electronic device 100 needs to have a data transmission function, that is, the electronic device 100 needs to include a communication module. Figure 1b Communication modules such as the RF circuit 110, the WiFi module 190, and the communication interface 180 are shown, but it is understandable that at least one of the above components or other communication modules (such as a Bluetooth module) for implementing communication exist in the electronic device 100 to perform data transmission.

[0051] For example, when the electronic device 100 is a mobile phone, the electronic device 100 may include the RF circuit 110 and may also include the WiFi module 190; when the electronic device 100 is a computer, the electronic device 100 may include the communication interface 180 and may also include the WiFi module 190; when the electronic device 100 is a tablet computer, the electronic device 100 may include the WiFi module.

[0052] The memory 140 can be used to store software programs and modules. The processor 130 executes various functional applications and data processing of the electronic device 100 by running the software programs and modules stored in the memory 140. Optionally, the memory 140 may mainly include a program storage area and a data storage area. Among them, the program storage area can store an operating system (mainly including the kernel layer, system layer, application framework layer and application layer, etc., each corresponding software program or module). Among them, the application layer can include various applications, and then in the embodiment of the present application, based on the stored source code, a security scan is performed using the method provided in the present application.

[0053] In addition, the memory 140 may include a high-speed random access memory and may also include a non-volatile memory, such as at least one disk storage device, a flash memory device, or other volatile solid-state storage devices.

[0054] The input unit 150 may be used to receive user input of various types of data objects such as numbers or characters, and to generate key signal inputs related to user settings and function control of the electronic device 100. Optionally, the input unit 150 may include a touch panel 151 and other input devices 152.

[0055] Among them, the touch panel 151, also known as a touch screen, can collect user touch operations on or near it (for example, the user uses fingers, stylus or any other suitable objects or accessories on or near the touch panel 151) and drive the corresponding connection device according to a pre-set program.

[0056] Optionally, the other input devices 152 may include, but are not limited to, one or more of a physical keyboard, function keys (such as volume control keys, switch keys, etc.), a trackball, a mouse, a joystick, etc.

[0057] The display unit 160 can be used to display information input by the user or information provided to the user and various menus of the electronic device 100. The display unit 160 is the display system of the electronic device 100, which is used to present an interface and realize human-computer interaction. The display unit 160 may include a display panel 161. Optionally, the display panel 161 can be configured in the form of a liquid crystal display (LCD), an organic light-emitting diode (OLED), etc. In an embodiment of the present application, for example, the results obtained after the security scan can be displayed by the display unit 160.

[0058] The processor 130 is the control center of the electronic device 100. It connects various components using various interfaces and lines. By running or executing software programs and / or modules stored in the memory 140 and calling data stored in the memory 140, it performs various functions of the electronic device 100 and processes data, thereby realizing various services based on the electronic device. In the embodiment of the present application, the processor 130 is used to implement the security scanning method provided by the present application, thereby realizing the detection of security vulnerabilities in static source code.

[0059] The electronic device 100 further includes a power supply 120 (e.g., a battery) for supplying power to various components. Optionally, the power supply 120 may be logically connected to the processor 130 via a power management system, thereby managing charging, discharging, and power consumption through the power management system.

[0060] like Figure 1bAs shown, the electronic device 100 also includes an audio circuit 170, a microphone 171 and a speaker 172, which can provide an audio interface between the user and the electronic device 100. The audio circuit 170 can be used to convert audio data into a signal that can be recognized by the speaker 172, and transmit the signal to the speaker 172, which is converted into a sound signal for output by the speaker 172. The microphone 171 is used to collect external sound signals (such as the sound of a person speaking or other sounds, etc.), and convert the collected external sound signals into signals that can be recognized by the audio circuit 170 and send them to the audio circuit 170. The audio circuit 170 can also be used to convert the signal sent by the microphone 171 into audio data, and then output the audio data to the RF circuit 110 to send it to, for example, another terminal, or output the audio data to the memory 140 for subsequent further processing.

[0061] Although not shown, the electronic device 100 may further include at least one sensor, camera, etc., which will not be described in detail here.

[0062] The operating system (OS) involved in the embodiments of this application is the most basic system software running on electronic devices. Taking a smartphone as an example, the operating system can be an Android system or an iOS system. The following embodiments are described using the Android system as an example. Those skilled in the art will understand that similar methods can also be used to implement other operating systems.

[0063] The software system of the electronic device can adopt a layered architecture, an event-driven architecture, a micro-kernel architecture, a microservice architecture, or a cloud architecture. The embodiment of the present application takes the Android system adopting a layered architecture as an example to illustrate the software structure of the electronic device. Figure 1c The following is a block diagram of the software structure of the Android system provided by an embodiment of the present application. The layered architecture divides the software into several layers, each with clear roles and divisions of labor. Layers communicate with each other via software interfaces. In some embodiments, the Android system is divided into five layers: the application layer, the application framework layer, the Android runtime and system libraries, the hardware abstraction layer, and the kernel layer.

[0064] The application layer is the top layer of the operating system and can include a series of application packages. Figure 1cAs shown, the application layer can include native applications of the operating system and third-party applications. The native applications of the operating system can include the user interface (UI), camera, settings, mobile manager, music, short messages, calls, etc., and third-party applications can include maps, music, videos, etc. The applications mentioned below can be native applications of the operating system installed on the electronic device when it leaves the factory, or they can be third-party applications downloaded from the Internet or obtained from other electronic devices when the user uses the electronic device.

[0065] In some embodiments of the present application, the application layer can be used to implement the presentation of the editing interface, and the editing interface can be used by the user to implement the operation of obtaining the detected static source code in the embodiments of the present application. For example, the user can Figure 4 The editing interface of the front-end interface shown is used to select the static source code to be detected, or the version.

[0066] In one possible implementation, applications can be developed using Java by calling the application programming interface (API) provided by the application framework layer. Developers can use the application framework layer to interact with the underlying operating system layers (such as the hardware abstraction layer and kernel layer) to develop their own applications. The application framework layer primarily provides a series of services and management systems for the operating system.

[0067] The application framework layer provides application programming interfaces and programming frameworks for applications in the application layer. The application framework layer includes some predefined functions. Figure 1c As shown, the application framework layer may include a window manager, a content provider, a view system, a phone manager, a resource manager, a notification manager, and the like.

[0068] The window manager is used to manage window programs. The window manager can obtain the size of the display screen, determine whether there is a status bar, lock the screen, take screenshots, etc. The content provider is used to store and obtain data and make the data accessible to applications. The data may include video, images, audio, calls made and received, browsing history and bookmarks, phone books, etc. The view system includes visual controls, such as text controls for displaying text, picture controls for displaying pictures, etc. The view system can be used to build applications. The display interface can be composed of one or more views. The phone manager is used to provide communication functions for the electronic device 100, such as management of call status display (including connecting, hanging up, etc.). The resource manager provides various resources for applications, such as localized strings, icons, pictures, layout files, video files, etc.

[0069] In some embodiments of the present application, the application framework layer is mainly responsible for calling the service interface for communication with the hardware abstraction layer to pass the security scan request to the hardware abstraction layer. The request also includes predefined programming of the security scanning service, which is used to implement the requirement of this application to perform a security scan on the static source code being detected; it is also responsible for managing the username and password for login authentication, etc.

[0070] Exemplarily, the security scanning service may include an acquisition module, a first structure generation module, a stream data generation module, a security scanning module, and the like for implementing the method provided in this application.

[0071] The acquisition module is used to acquire the detected static source code in response to a security scanning instruction.

[0072] The above-mentioned first structure generation module is used to convert the detected static source code into a first structural representation based on the key syntax information and code line number information contained in the detected static source code; wherein the first structure is used to indicate the key syntax information contained in the detected static source code, and the first structural representation contains the code line number information of each key syntax information in the detected static source code.

[0073] The stream data generation module is configured to generate a stream data representation of the static source code under inspection based on the first structural representation, wherein the stream data indicates at least one logical relationship contained in the static source code under inspection. The generated stream data is used for security scanning, and because the stream data can reflect the logical relationships in the source code, the security scanning results are more accurate.

[0074] A security scanning module is used to perform a security scan based on the stream data.

[0075] The Android runtime consists of a core library and a virtual machine. The Android runtime is responsible for scheduling and managing the Android system. The Android system's core library consists of two parts: one for the Java language's callable functions and the other for the Android core library.

[0076] The application layer and application framework layer run in a virtual machine. For example, in the Java language, the virtual machine executes Java files in the application layer and application framework layer as binary files. The virtual machine manages object lifecycles, stack management, thread management, security and exception management, and garbage collection.

[0077] The system library can include multiple functional modules, such as a surface manager, media libraries, a 3D graphics processing library (such as OpenGL ES), and a 2D graphics engine (such as SGL).

[0078] The surface manager manages the display subsystem and provides fusion of 2D and 3D layers for multiple applications. The media library supports playback and recording of various common audio and video formats, as well as static image files. The media library supports a variety of audio and video encoding formats, such as MPEG4, H.264, MP3, AAC, AMR, JPG, and PNG. The 3D graphics processing library implements 3D graphics drawing, image rendering, compositing, and layer processing. The 2D graphics engine is the drawing engine for 2D drawing.

[0079] In some embodiments of the present application, the system library may also include a security scanning service password and a security scanning service configuration file, which are responsible for providing a service interface for communicating with the application framework layer and managing the configuration files and passwords required for the security scanning service. The security scanning service configuration file may be used to store information about the security scanning service, and the security scanning service password may be used to store information such as the authentication username and login password required for the user account that needs to perform a security scan to obtain specific static source code to be inspected.

[0080] The hardware abstraction layer (HAL) supports the application framework layer and is an important link between the application framework layer and the kernel layer. It can provide services to developers through the application framework layer.

[0081] Exemplarily, the function of the security scanning service in the embodiment of the present application can be implemented by configuring a first process in the hardware abstraction layer. The first process can be a sub-process constructed separately in the hardware abstraction layer. The first process can include modules such as a security scanning service configuration interface and a security scanning service controller. The security scanning service configuration interface is a service interface that communicates with the application framework layer. The security scanning service controller is used to monitor the security scanning service configuration interface, for example, to control whether the security scanning service needs to be authenticated, etc. It is also responsible for monitoring whether the data input into the electronic device needs to be cached or updated. When the input data needs to be cached or updated, the application framework layer can be notified to cache or update the corresponding data to ensure that the display interface displays the latest data. The hardware abstraction layer can also include a daemon process, which can be used to cache data in the first process. The daemon process can also be a sub-process constructed separately in the hardware abstraction layer.

[0082] The kernel layer can be the Linux kernel layer, which is an abstract layer between hardware and software. The kernel layer has many drivers related to electronic devices, including at least a display driver; a frame buffer driver based on Linux; a keyboard driver and a mouse driver as input devices; a Flash driver based on a memory technology device; an audio driver; a Bluetooth driver, etc. The embodiments of the present application do not impose any restrictions on this. The Linux kernel layer is used to provide core system services of the operating system, such as security, memory management, process management, network protocol stacks, and driver models, which are all implemented based on the Linux kernel. In some embodiments of the present application, the Linux kernel relies on a local file system, which can be accessed through a security scanning service, and documents in the local file system can be configured through the security scanning service configuration interface of the hardware abstraction layer.

[0083] Typically, electronic devices can run multiple applications simultaneously. In simpler cases, one application corresponds to one process, while in more complex cases, one application corresponds to multiple processes. Each process has a process ID.

[0084] Combined with the above Figure 1b Introduction to the hardware structure of electronic equipment, and Figure 1c The software framework of the electronic device is introduced in the following. The following is an example of the working principles of the software and hardware of the electronic device 100 executing the security scanning method proposed in the embodiment of the present application, targeting the security scanning scenario.

[0085] It should be understood that in the embodiments of the present application, "at least one" refers to one or more, and "more" refers to two or more. "And / or" describes the association relationship of associated objects, indicating that three relationships may exist. For example, A and / or B can represent: the existence of A alone, the existence of A and B at the same time, and the existence of B alone, where A and B can be singular or plural. The character " / " generally indicates that the previous and next associated objects are in an "or" relationship. "At least one of the following" or similar expressions refers to any combination of these items, including any combination of single or plural items. For example, at least one of a, b or c can represent: a, b, c, a and b, a and c, b and c, or a, b and c, where a, b, c can be single or multiple.

[0086] The "multiple" involved in the embodiments of the present application refers to greater than or equal to two.

[0087] In addition, it should be understood that, in the description of this application, words such as "first" and "second" are only used for the purpose of distinguishing the description, and cannot be understood as indicating or implying relative importance, nor can they be understood as indicating or implying order.

[0088] In addition, in the embodiments of the present application, "electronic device", "device", "mobile phone" and the like can be used interchangeably, that is, they refer to various devices that can be used to implement the embodiments of the present application. In the following introduction, the embodiments of the present application will be introduced from the client side, where the client is the various devices that can be used to implement the embodiments of the present application. It should be understood that the hardware structure of the electronic device can be as follows: Figure 1b As shown, the software architecture can be Figure 1c As shown, the software programs and / or modules corresponding to the software architecture in the electronic device can be stored in the memory 140, and the processor 130 can run the software programs and applications stored in the memory 140 to execute the process of the security scanning method provided in the embodiment of the present application.

[0089] Before describing a security scanning method provided in an embodiment of the present application, a possible application scenario of the method provided in the present application is first introduced below. Figure 1d As shown, the application scenario includes a user 10, a client 11, and a server 12. The user 10 can obtain the detected static source code through the client 11, and then convert the detected static source code to obtain an abstract syntax tree structure, and then parse the abstract syntax tree structure to obtain a directed graph structure, and finally analyze based on the directed graph structure to obtain stream data, and send the stream data to the server 12, so that the server 12 can implement security scanning based on the stream data. Of course, in the specific implementation, the application scenario may also not have a server 12, and security scanning can be achieved only through the client 11, or part of the processing process can be handled by the server 12, that is, as long as a scenario of a security scanning method provided by this application can be implemented, this application is applicable. The client 11 here can have the above-mentioned Figure 1b The hardware architecture shown and Figure 1c The software architecture shown.

[0090] Next, the concepts and terms that may be involved in the embodiments of this application are explained to facilitate easier understanding of the methods provided by this application, as follows:

[0091] (1) Static source code, also known as static source program, is written by programmers using a language supported by development tools and is a series of computer-readable computer language instructions. Static source code consists of a set of characters that have specific meanings and can achieve specific functions.

[0092] Static source code has a baseline version and an iterative version. The baseline version represents the basis for the development of the static source code and can also be understood as the initial version, while the iterative version represents the static source code after modifications are made to the baseline version. The embodiments of the present application do not limit the number of times an iterative version can be modified relative to the baseline version. Static source code obtained after modifications, optimizations, and other updates to the baseline version of the static source code can be referred to as an iterative version.

[0093] (2) The abstract syntax tree (AST) is a tree representation of the abstract syntax structure of the static source code. Each syntax node in the tree can represent a structure in the static source code, such as a variable, function, method, etc. It is called an abstract syntax tree because not all details that appear in the static source code are presented in the AST structure. For example, some unimportant details are implicit in the tree structure and not presented as nodes in the tree. Unimportant details include colons, nested brackets, semicolons, etc.

[0094] (3) A directed graph, similar to an abstract syntax tree, is a representation of a static source code in a directed graph structure. For example, each sub-expression in an expression in the static source code has a node. Moreover, an internal node in the directed graph represents an operator in the static source code, and its child nodes represent operands.

[0095] Unlike an abstract syntax tree, nodes representing common subexpressions in a directed graph have multiple parents, while in an abstract syntax tree common subexpressions are represented as repeated subtrees.

[0096] For example, take the expression "a+a*(bc)+(bc)*d" as an example, see Figure 2 The figure shows an example of an abstract syntax tree and a directed graph tree. The abstract syntax tree represents expressions using nodes, but common subexpressions, such as "bc," are represented as repeated subtrees or nodes. In contrast, a directed tree represents expressions with a single node, and multiple parent nodes represent the different references of the subexpression.

[0097] (4) Graphical tree, abstract syntax tree and directed graph are essentially expressed in the form of software code. In order to understand the abstract syntax tree and directed graph more clearly, the directed graph can be represented in a tree form after being graphically treeed, such as Figure 2 In addition, after the directed graph is processed into a graph tree, it can also be called a directed tree.

[0098] (5) Control flow is a mechanism that arranges code elements in a certain logical order to determine the order in which the code is executed. In other words, control flow determines how the program should be executed next.

[0099] (6) Data flow is the representation of data operations on the control flow. Only data flow analysis performed on the control flow is valuable.

[0100] The following describes a security scanning method provided by the present application in conjunction with the accompanying drawings and through several possible embodiments.

[0101] Example 1

[0102] like Figure 3 FIG. 1 is a flow chart of a security scanning method provided in Example 1 of the present application, comprising the following steps:

[0103] Step 301: The client converts the detected static source code into a first structural representation; wherein the first structure is used to indicate key syntax information contained in the detected static source code, and the first structural representation includes code line number information of each key syntax information in the detected static source code.

[0104] When implementing, the client first obtains the static source code to be detected, see Figure 4 , is a possible front-end interface example diagram for obtaining the detected static source code provided in the embodiment of the present application. Figure 4 The front-end interface shown may include at least: the user account for authentication, the path to obtain the static source code to be tested, and the version type of the static source code to be tested (for example, it may include the baseline version of the static source code, the historical version selected last time, the version selected this time, the entry for selecting other versions, etc.). It should be noted that Figure 4 The front-end interface shown is merely an example provided by this application and does not limit the implementation method for obtaining the detected static code. Furthermore, users can also include controls in the front-end interface for more precise and detailed functions based on their security scanning needs. For example, options for static and dynamic security scanning can be included, allowing users to select the security scanning method according to their needs.

[0105] Among them, for each static source code being tested, if there is a historical security scan record of the static source code, then based on the comparison between the last selected historical version and the currently selected version, the code portion in the currently selected version that has been changed relative to the last selected historical version can be screened out, and then the security scan result of the current security scan is obtained by performing a security scan on the changed code portion, and then combined with the last security scan result to obtain a complete security scan result for the currently selected version of the static source code being tested. Through this embodiment, during each security scan of the static source code being tested, it is not necessary to scan the entire source code. By scanning the changed code portion, the security scan efficiency during the security scan process can be improved, thereby reducing the security scan time.

[0106] After the client obtains the static source code to be detected from the acquisition path, in order to solve the disadvantage of high false positives in the existing technology of directly performing security scanning based on the static source code, during the implementation of this application, the static source code to be detected is first converted into a first structural representation, which can be exemplarily an AST structure.

[0107] During implementation, a possible implementation method for the client to obtain the AST structure is, first, to translate the detected static source code into a concrete syntax tree (CST) structure, wherein the CST structure contains all the syntax information of the detected static source code, so the CST structure has the disadvantage of redundancy. Secondly, considering the redundancy problem of the CST structure, some unimportant detail information contained in the CST structure can be extracted, and then the AST structure can be obtained based on the key information contained in the CST structure (wherein the key information includes, for example, class structure, method structure, inheritance structure, etc.). In this way, the AST structure obtained by the client is a syntax tree representation of the key syntax structure components of the detected static source code, without relying on the syntax used in the detected static source code. Therefore, since the AST structure only extracts important information, a clearer and more concise interface can be obtained, thereby providing a portable channel for developers to operate the detected static source code.

[0108] In addition, since the program code of the AST structure generally output does not have code line numbers, in the embodiment of the present application, in order to improve the positioning capability of the security scan, the client can also parse the detected static source code based on the open source PLYJ component (a low-level component for parsing source code), and combine the line number information in the static source code with the generated abstract syntax tree structure. In specific implementation, during the parsing process, the client records the line number information of the parsed static source code, and records the first and last line number information of the current structure into the AST structure based on the composition of key information such as class structure and method structure, so that the AST structure after conversion has the line number tracking and positioning capability, thereby improving the precise positioning during security scanning and the ability to map to the detected static source code. For example, if the line number information of method A in the static source code is 7 to 10, in the software code with an AST structure, before introducing the content of method A, mark the following content corresponding to the code starting from line 7 in the static source code, for example, mark it as - "head_index": 7; similarly, after introducing the content of method A, mark the end of method A to line 10 in the static source code, for example, mark it as - "tail_index": 10. By marking the line number information in the software code with an AST structure, if a security vulnerability is found in method A from the AST structure during the security scan, based on the line number information marked before introducing method A, it can be determined from the static source code being tested that there is a security vulnerability in line numbers 7 to 10.

[0109] Step 302: The client obtains stream data according to the program code of the AST structure.

[0110] Since the application of a single AST structure of program code in security scanning has the problem of high complexity, when this application is implemented, the client further parses the AST structure to obtain multiple syntax nodes, and then obtains the logical relationship that can reflect the syntax information of the static source code being detected based on each syntax node and the calling relationship and / or called relationship of the syntax node, that is, the execution order of the program; finally, based on the logical relationship of the static source code, the control flow (CFG) and data flow (DFG) are obtained, and the control flow and data flow are integrated to obtain flow data. Among them, the control flow contained in the flow data can clearly reflect the logical relationship in the static source code being detected, and the data flow contained in the flow data is the data representation obtained after the data is operated based on the execution order of the logical relationship. When this application is implemented, the flow data can be used for security scanning, and the logical relationship can be obtained through the flow data, thereby improving the code tracking ability during the security scan, and then improving the efficiency of the security scan.

[0111] Step 303: The client sends the obtained stream data to the server.

[0112] Step 304: The server performs a security scan on the parsed stream data based on the security scanning rules.

[0113] Among them, the server analyzes the specific vulnerability component that causes the problem based on the security vulnerability, extracts specific key information (including fingerprints, keywords, method names, etc.) by analyzing the characteristics of the vulnerability component, and then obtains security scanning rules based on the key information.

[0114] Example 2

[0115] The following describes a specific implementation method for obtaining stream data according to the program code of the AST structure in step 302 of the first embodiment. Figure 5 As shown, the following steps are included:

[0116] Step 3021: The client parses the program code based on the AST structure to obtain a directed graph.

[0117] For example, there are methods A, B, C, and D in the static source code being tested. After the client converts the static source code being tested into a program code with an AST structure, due to the extraction of unimportant information in the static source code being tested, the program code based on the AST structure has the problem of not being able to obtain complete logical relationships. That is, the program code with the AST structure cannot reflect the logical relationships in the static source code being tested. It mainly contains multiple important syntax nodes, and the logical relationships between the syntax nodes cannot be realized.

[0118] During implementation, the client parses the syntax nodes in the program code of the AST structure and parses out multiple syntax nodes contained in the AST structure, such as method A, method B, method C, and method D. Then, the client can obtain the logical relationship between the method nodes based on the syntax nodes and the calling relationship and / or called relationship of each syntax node. For example, the client can obtain that method B receives the call of method A based on the calling relationship and / or called relationship of method B, and obtain that method C also receives the call of method A based on the calling relationship and / or called relationship of method C, and obtain that method D can receive the call of method B and the call of method C based on the calling relationship and / or called relationship of method D. Therefore, based on the analysis of the program code of the AST structure, the client can obtain that method D has two parent nodes. For details, please refer to Figure 6 The directed graph of .

[0119] In addition, in the static source code being tested, there may also be scenarios such as reflection (definition: the ability of a program to access, detect and modify its own state or behavior) and remote calls (definition: function calls between processes. Processes can exist on the same computer or on different computers. Remote does not refer to remoteness in terms of distance, but refers to the isolation between processes and crossing process boundaries, which is called remoteness). Therefore, when generating a directed graph from an undirected graph, these scenarios may not be associated in a timely manner, resulting in the problem of broken links in the directed graph obtained based on the AST structure, that is, it cannot accurately reflect the complete logical relationship in the static source code. Therefore, when the client generates a directed tree structure, in order to cover these scenarios, the specific implementation is to match the name in the method node through the functions in the software code or the string content contained in the function through reflection and remote calls, so as to achieve a complete logical relationship between method nodes, and thus more accurately reflect the software code execution logic in the static source code being tested.

[0120] Step 3022: The client generates a graph tree, ie, a directed tree, based on the directed graph nodes.

[0121] In order to more intuitively determine the logical relationship obtained from the program code based on the AST structure, the client expresses the obtained logical relationship in the form of a graphical tree. Figure 6 , shows an example of representing the directed graph obtained in step 3021 as a tree graph. In this example, method A is used as the first-level node, and points to the next called method one by one based on the logical relationship, wherein Figure 6 It can be seen that method D has two parent nodes, namely method B and method C.

[0122] Step 3023: The client generates a control flow and a data flow according to the directed tree.

[0123] The directed tree obtained in step 3022 can be used to obtain the logical relationships in the static source code being tested. Due to the complexity and intersection of the logical relationships in the static source code, there may be multiple directed paths starting from the vertex in the directed graph. In order to improve the ability to track the business logic of each directed path from the vertex during the security scan, the client converts each directed path in the directed graph into corresponding control flow and data flow. Among them, a directed tree can obtain at least one control flow. For example, Figure 6The directed tree shown in Figure 1 shows two control flows: "Direction A → Method B → Method D" and "Direction A → Method C → Method D." The data flow represents the data operations performed based on the execution order of the control flows. This direct tree generates multiple control and data flows, allowing for clear identification of the entry point for each control flow. Security scanning can then be performed starting from each entry point, improving security scanning capabilities.

[0124] Step 3024: The client integrates the data stream and the control stream to obtain stream data.

[0125] After the client obtains the flow data based on the integration of data flow and control flow, the obtained flow data can be sent to the server for security scanning. Since each control flow contained in the flow data can represent a directed path in the directed tree, the server can start from the entrance of each directed path more clearly and accurately, and perform security scanning on each directed path separately, thereby reducing the false alarm rate of the security scanning results and improving the accuracy of vulnerability detection.

[0126] Example 3

[0127] In order to more intuitively understand the implementation of a security scanning method provided by the embodiment of the present application through the client and the server, the following is combined with several possible scenarios and Figure 7a to Figure 7d The following first describes the abbreviations that may appear in the following embodiments, as shown in Table 1:

[0128] Table 1

[0129] English abbreviations Complete English expression / standard English terminology Chinese expressions / Chinese terms SAST static application security testing Static application security testing AG abstract syntax tree Generator Abstract syntax tree generator FGU flow graph unit Streaming data generation module SU scanner unit Security Scanner Module DNG digraph node generator Directed graph node generator GTG graph tree generator Graphical Tree Generator CG control flow graph generator Control Flow Generator DG data flow graph generator Data Stream Generator FGG flow graph generator Streaming Data Generator FGP flow graph parser Streaming data parser SRP scanner rule parser Security Scanning Rules Parser FGS flow graph scanner Stream Data Scanner

[0130] Combine Figure 1d A possible application scenario provided by the embodiment of the present application is shown in the figure, as well as an introduction to the implementation process of the method provided by the present application in the aforementioned embodiment. The following uses several possible scenarios to illustrate the implementation method of the method provided by the present application based on the interaction between the client and the server.

[0131] Scenario 1: Reference Figure 7a The diagram shows a schematic diagram of the structure of a security scanning method, including: an acquisition module 701, a first structure generation module 702, a stream data generation module 703 (FGU), and a security scanning module 704 (SU), wherein:

[0132] The first structure generation module 702 is used to generate a program code in a first structural form based on the acquired detected static source code after receiving and responding to a security scanning event, for indicating key grammatical information contained in the detected static source code. The static source code represented by the first structural form can more intuitively reflect the logical relationship between program codes.

[0133] Exemplarily, the first structure may be represented by an AST structure, and the first structure generating module 702 may be represented by an abstract syntax tree generator AG;

[0134] The FGU is used to further convert the program code in the AST structure form obtained through AG into a stream data form, and perform security scanning through the stream data, which can improve the efficiency of the security scanning.

[0135] The SU is used to perform a security scan on the stream data obtained by the FGU, thereby detecting security vulnerabilities in the static source code. It should be noted that, according to the description in the aforementioned embodiment, since the baseline version or iterative version can be selected when obtaining the static source code to be tested, or the previously selected historical version and the currently selected version can also be included, in order to further improve the efficiency of the security scan, before performing the security scan, the static source code in the form of stream data can be first determined to determine the code portions that have changed compared to the baseline version. Then, during the security scan, a security scan is performed based on the changed code portions. Finally, the security scan results obtained by the SU are displayed on the front-end interface to facilitate user analysis of the security scan results.

[0136] In this scenario, the security scanning module 704 is located at the server, and the first structure generating module 702 and the stream data generating module 703 are located at the client.

[0137] Scenario 2: During implementation, refer to Figure 7b As shown, based on scenario 1, the stream data generation module 703 (FGU) specifically includes: a second structure generation module, a graph tree generator (GTG), a control flow generator (CG), a data flow generator (DG), and a stream data generator (FGG). The output of the stream data generator FGG is the static source code in the form of stream data, where:

[0138] The second structure generation module is used to convert the program code in the AST structure form output by the AG into a program code represented by a second structure containing the logical relationship of multiple syntax nodes in the detected static source code, so as to parse out multiple syntax nodes in the AST structure, and obtain the logical relationship of the static source code based on the multiple syntax nodes and the calling relationship and / or called relationship of each syntax node. Exemplarily, the second structure can be represented by a directed graph structure, and the second structure generation module can be a directed graph node generator (DNG).

[0139] The GTG is used to generate a tree structure representation from the static source code of the directed graph structure, thereby obtaining a directed tree, for example Figure 6 The schematic diagram shown.

[0140] The CG is used to extract at least one logical relationship in the directed tree, thereby obtaining the execution order in the static source code as a control flow, wherein one control flow is used to represent a logical relationship in the directed tree.

[0141] The DG is used to obtain the data parameters based on the control flow obtained by the control flow generator CG, and perform data operation representation according to the control direction of the control flow according to the data parameters in the directed tree to obtain the data flow, wherein each control flow corresponds to a data flow.

[0142] The FGG is used to integrate the flow data obtained based on the control flow obtained by the CG and the data flow obtained by the DG.

[0143] See Figure 7b As shown, based on scenario 1, the security scanning module 704 (SU) specifically includes: a flow data parser (FGP), a security scanning rule parser (SRP), and a flow data scanner (FGS).

[0144] The FGP is used to parse the received stream data to parse out all control streams and data streams contained in the stream data, so that the parsed control streams and data streams can be used for security scanning.

[0145] The SRP is used to provide security scanning rules. These rules are generated by analyzing the specific vulnerable components that cause issues based on security vulnerabilities, based on the characteristics of the source code being tested. By analyzing the characteristics of the vulnerable components and extracting specific key information, the security scanning rules can be used to determine if a security vulnerability exists based on a search keyword matched against the data content in the stream data.

[0146] The FGS is used to perform security scanning on the stream data parsed by the stream data parser FGP based on the security scanning rules.

[0147] Application scenario 3, see Figure 7c This scenario is similar to the method flow of implementing the present application in Scenario 1. However, the difference from Scenario 1 is that, in order to reduce the processing pressure on the client, this scenario provides a method of placing the operations performed by the stream data generation module 703 on the server, thereby reducing the computing pressure on the client.

[0148] Application scenario 4, reference Figure 7d This scenario is similar to the method flow of implementing the present application in Scenario 1, and different from Scenario 1 is that this scenario can realize the ability of a single machine to perform security scanning. Specifically, the operations performed by the security scanning module 704 are placed on the client, so that the client implements the entire security scanning process, thereby realizing that when the client has processing capabilities, there is no need to interact with the server to implement security scanning.

[0149] See Figure 8a , is a front-end schematic diagram of a security scan result display list provided in an embodiment of the present application, for example, the front-end display interface includes the security scan status of various sub-products, such as Figure 8a The sub-product tasks with task IDs 2 and 5 are in the security scanning state; and the front-end display interface may also include the execution progress and filing status, so as to obtain the security scanning results for different sub-products.

[0150] See Figure 8b , is a schematic diagram of a security scan result provided in an embodiment of the present application, Figure 8b Different from Figure 8a , which is used to display detailed security scan results for a task. Through this front-end interface, you can view the code lines where possible security vulnerabilities are located and problem details, etc., so that developers can confirm the results of the security scan.

[0151] In the embodiments provided in the present application above, the methods provided in the embodiments of the present application are introduced from the perspective of an electronic device as an execution subject. In order to implement the various functions in the methods provided in the embodiments of the present application above, the electronic device may include a hardware structure and / or a software module, and implement the above functions in the form of a software module or a hardware structure combined with a software module. Whether a function of the above functions is executed in the form of a hardware structure, a software module, or a hardware structure plus a software module depends on the specific application and design constraints of the technical solution.

[0152] like Figure 9As shown, the embodiment of the present application discloses an electronic device 900, which may include: one or more processors 901 and a memory 902. The multiple processors 901 and the memory 902 may be connected via one or more communication summaries. The program instructions are stored in the above-mentioned memory 902 and configured to be executed by the one or more processors 901, wherein:

[0153] The processor 901 is used to execute a response to a security scan instruction to obtain the detected static source code; based on the key syntax information and code line number information contained in the detected static source code, the detected static source code is converted to obtain a first structural representation; wherein the first structure is used to indicate the key syntax information contained in the detected static source code, and the first structural representation contains code line number information of each key syntax information in the detected static source code; based on the first structural representation, a stream data representation of the detected static source code is obtained, and the stream data is used to indicate at least one logical relationship contained in the detected static source code; and a security scan is performed based on the stream data.

[0154] In one possible design, when the processor 901 is used to execute a flow data representation of the detected static source code based on the first structural representation, the specific execution is: parsing from the first structural representation to obtain multiple syntax nodes, each syntax node having a calling relationship and / or a called relationship; based on the calling relationship and / or the called relationship of each syntax node, generating a second structural representation of the detected static source code; the second structure contains the logical relationship of multiple syntax nodes in the detected static source code; according to the second structural representation, a tree structure representation is obtained, and the tree structure is used to indicate the logical relationship of multiple syntax nodes in the detected static source code; based on the tree structure, at least one control flow and a data flow matching each control flow are generated; wherein each control flow is used to indicate a logical relationship; the control flow and the data flow are integrated to obtain the flow data representation.

[0155] In one possible design, the processor 901 is used to execute, in response to a security scanning instruction, obtaining the static source code to be detected, and specifically performing: in response to a security scanning instruction for a static source code baseline version, using the static source code baseline version as the static source code to be detected; or, in response to a security scanning instruction for an iterative version of a static source code, and locally storing the security scanning results of the static source code baseline version, obtaining the code portion of the iterative version of the static source code that has changed relative to the baseline version, and using the changed code portion as the static source code to be detected; or, in response to a security scanning instruction for an iterative version of a static source code, and locally storing the security scanning results of a historical iterative version of the static source code, obtaining the code portion of the iterative version of the static source code that has changed relative to the historical iterative version, and using the changed code portion as the static source code to be detected.

[0156] Exemplarily, the key syntax information includes at least one of the following: a class structure, a method structure, and an inheritance structure; the first structure may be represented as an abstract syntax tree structure; and the second structure may be represented as a directed graph structure.

[0157] In one possible design, when the processor 901 performs a security scan based on the stream data, it specifically performs: traversing the stream data based on a retrieval keyword used for security scanning, where the retrieval keyword is obtained through a security scanning rule; if there is data matching the retrieval keyword in the traversed stream data, it indicates that a security vulnerability exists.

[0158] The processors involved in the above embodiments may be general-purpose processors, digital signal processors (DSPs), application-specific integrated circuits (ASICs), field programmable gate arrays (FPGAs), or other programmable logic devices, discrete gate or transistor logic devices, or discrete hardware components. The methods, steps, and logic block diagrams disclosed in the embodiments of this application may be implemented or executed. The general-purpose processor may be a microprocessor or any conventional processor. The steps of the methods disclosed in the embodiments of this application may be directly implemented as being executed by a hardware decoding processor, or may be executed by a combination of hardware and software modules in the decoding processor. The software module may be located in a storage medium mature in the art, such as random access memory (RAM), flash memory, read-only memory (ROM), programmable read-only memory, electrically erasable programmable memory, or registers. The storage medium is located in a memory, and the processor reads instructions from the memory and, in conjunction with its hardware, completes the steps of the above method.

[0159] Specifically, the specific implementation of the above electronic device 900 can refer to the relevant introduction in the method part, which will not be repeated here.

[0160] Those skilled in the art will appreciate that the units and algorithm steps described in the various examples in conjunction with the embodiments disclosed herein can be implemented using electronic hardware, or a combination of computer software and electronic hardware. Whether these functions are implemented in hardware or software depends on the specific application and design constraints of the technical solution. Professionals and technicians may use different methods to implement the described functions for each specific application.

[0161] Those skilled in the art will clearly understand that, for the convenience and brevity of description, the specific working processes of the systems, devices and units described above can refer to the corresponding processes in the aforementioned method embodiments and will not be repeated here.

[0162] In the several embodiments provided in this application, it should be understood that the disclosed devices and methods can be implemented in other ways. For example, the device embodiments described above are merely schematic. For example, the division of the units is merely a logical function division. In actual implementation, there may be other division methods, such as multiple units or components can be combined or integrated into another system, or some features can be ignored or not executed. Another point is that the mutual coupling or direct coupling or communication connection shown or discussed can be through some interfaces, indirect coupling or communication connection of devices or units, which can be electrical, mechanical or other forms.

[0163] The units described as separate components may or may not be physically separate, and the components shown as units may or may not be physical units, that is, they may be located in one place or distributed across multiple network units. Some or all of these units may be selected to achieve the purpose of this embodiment according to actual needs.

[0164] In addition, each functional unit in each embodiment of the present application may be integrated into one processing unit, or each unit may exist physically separately, or two or more units may be integrated into one unit.

[0165] If the functions are implemented in the form of software functional units and sold or used as independent products, they can be stored in a computer-readable storage medium. Based on this understanding, the technical solution of the present application, or the part that contributes to the prior art, or the part of the technical solution, can be embodied in the form of a software product. The computer software product is stored in a storage medium and includes several instructions for enabling a computer device (which can be a personal computer, server, or network device, etc.) or a processor to execute all or part of the steps of the method described in each embodiment of the present application. The aforementioned storage medium includes various media that can store program codes, such as a USB flash drive, a mobile hard disk, a ROM, a RAM, a magnetic disk, or an optical disk.

[0166] The above is only a specific implementation method of the present application, but the scope of protection of the present application is not limited thereto. Any changes or replacements that can be easily thought of by any technician familiar with this technical field within the technical scope disclosed in this application should be included in the scope of protection of the present application. Therefore, the scope of protection of the present application should be based on the scope of protection of the claims.

Claims

1. A security scanning method, characterized in that: The method includes: In response to a security scanning instruction, obtaining a detected static source code; According to the key grammatical information contained in the detected static source code, the detected static source code is converted into a first structure representation; wherein the first structure is used to indicate the key grammatical information contained in the detected static source code; Parsing the first structural representation to obtain a plurality of syntax nodes, each syntax node having a calling relationship and / or a called relationship; Based on the calling relationship and / or called relationship of each syntax node, a second structural representation of the detected static source code is generated; the second structure includes the logical relationship between multiple syntax nodes in the detected static source code; Obtaining a tree structure representation according to the second structure representation, wherein the tree structure is used to indicate a logical relationship between a plurality of syntax nodes in the detected static source code; Based on the tree structure, generating at least one control flow and a data flow matching each control flow; wherein each control flow is used to indicate a logical relationship; Integrating the control flow and the data flow to obtain a flow data representation of the detected static source code, wherein the flow data is used to indicate at least one logical relationship contained in the detected static source code; A security scan is performed based on the stream data.

2. The method according to claim 1, characterized in that The step of obtaining the detected static source code in response to the security scanning instruction includes: In response to a security scan instruction for a static source code baseline version, using the static source code baseline version as the detected static source code; or In response to a security scan instruction for an iterative version of a static source code, and with a security scan result for a baseline version of the static source code locally stored, obtaining a code portion of the iterative version of the static source code that has been changed relative to the baseline version, and using the changed code portion as the static source code to be detected; or In response to a security scan instruction for an iterative version of a static source code, and with a security scan result for a historical iterative version of the static source code stored locally, a code portion of the iterative version of the static source code that has been changed relative to the historical iterative version is obtained, and the changed code portion is used as the static source code to be detected.

3. The method according to claim 1 or 2, characterized in that The key grammatical information includes at least one of the following: class structure, method structure, inheritance structure; The first structure is represented as an abstract syntax tree structure.

4. The method according to claim 1, wherein The second structure is represented as a directed graph structure.

5. The method according to claim 1, wherein Performing a security scan based on the flow data includes: Traversing the stream data based on a search keyword for security scanning, the search keyword being obtained through a security scanning rule; If data matching the search keyword exists in the traversed stream data, it indicates that a security vulnerability exists.

6. A security scanning device, characterized in that: The device includes: An acquisition module, configured to acquire the detected static source code in response to a security scanning instruction; A first structure generation module is configured to convert the detected static source code into a first structure representation according to key grammatical information contained in the detected static source code, wherein the first structure is used to indicate the key grammatical information contained in the detected static source code; a second structure generation module configured to parse the first structure representation to obtain a plurality of syntax nodes, each syntax node having a calling relationship and / or a called relationship; and generate a second structure representation of the detected static source code based on the calling relationship and / or the called relationship of each syntax node; the second structure comprising the logical relationships between the plurality of syntax nodes in the detected static source code; a graphical tree generator, configured to obtain a tree structure representation according to the second structure representation, wherein the tree structure is used to indicate a logical relationship between a plurality of syntax nodes in the detected static source code; A control flow generator, configured to generate at least one control flow based on the tree structure; wherein each control flow is used to indicate a logical relationship; A data flow generator, configured to generate data flows matching each control flow based on the tree structure and the at least one control flow; a flow data generator, configured to integrate the control flow and the data flow to obtain a flow data representation of the detected static source code, wherein the flow data is used to indicate at least one logical relationship contained in the detected static source code; A security scanning module is used to perform a security scan based on the stream data.

7. The device according to claim 6, characterized in that The acquisition module is specifically used to: In response to a security scan instruction for a static source code baseline version, using the static source code baseline version as the detected static source code; or In response to a security scan instruction for an iterative version of a static source code, and with a security scan result for a baseline version of the static source code locally stored, obtaining a code portion of the iterative version of the static source code that has been changed relative to the baseline version, and using the changed code portion as the static source code to be inspected; or, In response to a security scan instruction for an iterative version of a static source code, and with a security scan result for a historical iterative version of the static source code stored locally, a code portion of the iterative version of the static source code that has been changed relative to the historical iterative version is obtained, and the changed code portion is used as the static source code to be detected.

8. The device according to claim 6 or 7, characterized in that The key grammatical information includes at least one of the following: class structure, method structure, inheritance structure; The first structure is represented as an abstract syntax tree structure.

9. The device according to claim 6, characterized in that The second structure is represented as a directed graph structure.

10. The device according to claim 6, characterized in that The security scanning module specifically includes: a security scanning rule parser, configured to traverse the stream data based on a search keyword for security scanning, the search keyword being obtained through a security scanning rule; The stream data scanner is used to confirm the existence of a security vulnerability when data matching the search keyword is found in the traversed stream data.

11. A computing device, characterized in that The computing device includes a processor and a memory; The memory stores computer program instructions; The processor calls the computer program instructions in the memory to perform the method according to any one of claims 1 to 5.

12. A computing device cluster, characterized in that: A plurality of computing devices according to claim 11 are included.

13. A computer program product, characterized in that The method comprises computer instructions, which, when executed on a computing device, cause the computer to perform the method according to any one of claims 1 to 5.

Images